CVE-2026-92099

CVE-2026-92099 This vulnerability affects the WPGraphQL ecosystem, specifically WPGraphQL Smart Cache and all the version under " + Target Vulnerable! | ... Credits msfire https://github.com/MS-0x404...

CVE-2025-51529

CVE-2025-51529: WordPress Cookies and Content Security Policy Plugin DoS Vulnerability Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin through version 2.29 allows remote attackers to cause a denial of service database server...

CVE-2026-126619

Progressive Robot hMailServer versions 6.0.0-B1 through 6.3.7 are vulnerable to a misinterpretation of SQL statement text in the database layer. The vulnerability occurs because the layer erroneously reports failed database writes as successful when it detects the [IGNORE-ERRORS] marker. While in...

CVE-2026-126619 Misinterpretation of Input in hMailServer

Misinterpretation of SQL statement text in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 allows a remote unauthenticated attacker to have a failed database write reported to the server as successful. The layer answers a failed statement as a success when it finds the...

CVE-2026-118795

Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access...

CVE-2026-118795 AIS stores authorization state in locally modifiable databases

Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access...

EUVD-2026-120032

Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access...

CVE-2026-118795

Software from CompuGroup Medical is affected by a vulnerability where administrative roles and module permissions are stored in mutable local database fields . This configuration allows for privilege escalation by attackers who possess database write access . No specific remediation or exploit de...

CVE-2026-118795: CompuGroup Medical: Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation…

Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access...

ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization

Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare editRole / publishRole the core @apostrophecms/archive-page does, so a project can define restricted subtrees that only higher-privileged roles may create or edit within. The move operation in the...

CVE-2026-111446

Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/ to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without...

EUVD-2026-102608

Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/ to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without...

CVE-2026-111446

Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/ to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without...

CVE-2026-111446

Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/ to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without...

CVE-2026-111446

Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/ to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without...

CVE-2026-85000

The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the si...

EUVD-2026-100851

The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the si...

CVE-2026-109954

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients'...

CVE-2026-109954

Parse Server versions 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 are vulnerable to a race condition (CWE-362) where transactional batch state is shared across concurrent requests. This allows a client's transactional batch request to interfere with other clients' database writes. On Post...

CVE-2026-109954: Concurrent Execution using Shared Resource with Improper Synchronization

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients'...